Recommending remediation actions for incidents identified by performance management systems

Abstract

According to an aspect, a (recommendation) system constructs a knowledge graph based on problem descriptors and remediation actions contained in multiple incident reports previously received from a performance management (PM) system. Each problem descriptor and remediation action in an incident report are represented as corresponding start node and end node in the knowledge graph, with a set of qualifier entities in the incident report represented as causal links between the start node and the end node. Upon receiving an incident report related to an incident identified by the PM system, the system extracts a problem descriptor and a set of qualifier entities. The system traverses the knowledge graph starting from a start node corresponding to the extracted problem descriptor using the set of qualifier entities to determine end nodes representing a set of remediation actions. The system provides the set of remediation actions as recommendations for resolving the incident.

What is claimed is: 
     
       1. A non-transitory machine-readable medium storing one or more sequences of instructions, wherein execution of said one or more instructions by one or more processors contained in a digital processing system cause said digital processing system to recommend remediation actions, said one or more sequences of instructions comprises: an entity extractor for receiving a plurality of incident reports related to incidents identified by a performance management system, each incident report containing a corresponding problem descriptor for that incident, a remediation action performed for resolving that incident, and a set of qualifier entities associated with the incident, wherein said plurality of incident reports together contain a set of problem descriptors and a set of remediation actions; a knowledge graph module for constructing based on said plurality of incident reports, a knowledge graph that co-relates each of said set of problem descriptors with each of said set of remediation actions, wherein each of said set of problem descriptors is represented as a corresponding start node and each of said set of remediation actions is represented as a corresponding end node in said knowledge graph, wherein a set of qualifier entities in each incident report is represented as causal links between the start node and the end node corresponding to the problem descriptor and remediation action contained in the incident report, said knowledge graph module storing said knowledge graph in a memory provided in said digital processing system; said entity extractor, upon receiving a first incident report related to a first incident identified by said performance management system, extracting from said first incident report, a first problem descriptor and a first set of qualifier entities; said knowledge graph module for traversing said knowledge graph stored in said memory starting from a first start node corresponding to said first problem descriptor using said first set of qualifier entities to determine end nodes representing a first set of remediation actions; an orchestrator for causing resolution of said first incident based on one or more remediation actions of said first set of remediation actions, and upon resolution of said first incident, said knowledge graph module updating said knowledge graph in said memory based on said first incident to form an updated knowledge graph, wherein said updated knowledge graph is stored in said memory and used for resolving a later incident report received after resolution of said first incident report, wherein each of said entity extractor, said knowledge graph module, and said orchestrator is constituted of a corresponding set of software instructions. 
     
     
       2. The non-transitory machine-readable medium of  claim 1 , wherein said knowledge graph module maintains a respective confidence score associated with each path from said first problem descriptor to each remediation action of said first set of remediation actions, wherein the confidence score for a path represents a likelihood of resolution of said first problem descriptor by the corresponding remediation action, wherein said one or more sequences of instructions further comprises: a blender module for identifying rankings for said first set of remediation actions based on the associated confidence scores, wherein said orchestrator uses said rankings along with said first set of remediation actions to cause resolution of said first incident, wherein said blender module is constituted of a corresponding set of software instructions. 
     
     
       3. The non-transitory machine-readable medium of  claim 2 , wherein said entity extractor extracts a second problem descriptor with a second weight along with said first problem descriptor with a first weight,
 wherein said knowledge graph module determines a second set of remediation actions and associated confidence scores for said second problem descriptor, 
 wherein said blender module identifies rankings for both of said first set of remediation actions and said second set of remediation actions together based on associated confidence scores weighted by the respective said first weight and said second weight, 
 wherein said updating comprises adding one or more problem descriptors of said first incident report as corresponding start nodes and each of said one or more remediation actions as respective end nodes in said knowledge graph to form said updated knowledge graph. 
 
     
     
       4. The non-transitory machine-readable medium of  claim 1 , said one or more sequences of instructions comprising a classification engine for: classifying said first incident as being one of a short head incident and a long tail incident; if said first incident is classified as said short head incident, said orchestrator using said first set of remediation actions for resolving said first incident; and if said first incident is classified as said long tail incident, said one or more sequences of instructions comprising a web search module for performing a web search to determine a third set of remediation actions, wherein said orchestrator uses said third set of remediation actions for resolving said first incident, wherein each of said web search module and said classification engine is constituted of a corresponding set of software instructions. 
     
     
       5. The non-transitory machine-readable medium of  claim 4 , wherein said classification engine comprises one or more instructions for:
 generating a machine learning (ML) model correlating a set of problem types contained in said plurality of incident reports to a number of occurrences of each problem type in said knowledge graph; and 
 predicting using said ML model, whether said first incident is one of said short head incident and said long tail incident based on a first problem type determined for said first incident. 
 
     
     
       6. The non-transitory machine-readable medium of  claim 4 , said orchestrator further comprising one or more instructions for combining said first set of remediation actions and said third set of remediation actions to generate a final set of remediation actions,
 wherein said orchestrator uses said final set of remediation actions for resolving said first incident. 
 
     
     
       7. The non-transitory machine-readable medium of  claim 1 , wherein said first problem descriptor is one of a root cause of said first incident and a symptom caused by said first incident,
 wherein said first set of qualifier entities includes one or more of a performance metric associated with said first incident, a component of an application where said first incident occurred, a sub-component of said application where said first incident occurred, a location of a server hosting said component, and a problem type determined for said first incident, 
 wherein said first set of qualifier entities also includes said symptom when said problem descriptor is said root cause, and said root cause when said problem descriptor is said symptom. 
 
     
     
       8. A computer-implemented method for recommending remediation actions, the method comprising: receiving, by an entity extractor, a first incident report related to a first incident identified by a performance management system; extracting, by said entity extractor, from said first incident report, a first problem descriptor and a first set of qualifier entities; traversing, by a knowledge graph module, a knowledge graph stored in a memory to determine a first set of remediation actions, wherein said knowledge graph co-relates each of a set of problem descriptors with each of a set of remediation actions, wherein said set of problem descriptors and said set of remediation actions are contained in a plurality of incident reports previously received from said performance management system, wherein each of said set of problem descriptors is represented as a corresponding start node and each of said set of remediation actions is represented as a corresponding end node in said knowledge graph, wherein a set of qualifier entities in each incident report is represented as causal links between the start node and the end node corresponding to the problem descriptor and remediation action contained in the incident report, wherein said traversing starts from a first start node corresponding to said first problem descriptor and uses said first set of qualifier entities to determine end nodes representing said first set of remediation actions; causing, by an orchestrator, resolution of said first incident based on one or more remediation actions of said first set of remediation actions, and upon resolution of said first incident, said knowledge graph module updating said knowledge graph in said memory based on said first incident to form an updated knowledge graph, wherein said updated knowledge graph is stored in said memory and used for resolving a later incident report received after resolution of said first incident report, wherein each of said entity extractor, said knowledge graph module, and said orchestrator is constituted of a corresponding set of software instructions. 
     
     
       9. The method of  claim 8 , further comprising: maintaining, by said knowledge graph module, a respective confidence score associated with each path from said first problem descriptor to each remediation action of said first set of remediation actions, wherein the confidence score for a path represents a likelihood of resolution of said first problem descriptor by the corresponding remediation action; and identifying, by a blender module, rankings for said first set of remediation actions based on the associated confidence scores, wherein said orchestrator uses said rankings along with said first set of remediation actions to cause resolution of said first incident, wherein said blender module is constituted of a corresponding set of software instructions. 
     
     
       10. The method of  claim 9 , wherein said extracting extracts a second problem descriptor with a second weight along with said first problem descriptor with a first weight,
 wherein said traversing determines a second set of remediation actions and associated confidence scores for said second problem descriptor, 
 wherein said identifying identifies rankings for both of said first set of remediation actions and said second set of remediation actions together based on associated confidence scores weighted by the respective said first weight and said second weight, 
 wherein said updating comprises adding one or more problem descriptors of said first incident report as corresponding start nodes and each of said one or more remediation actions as respective end nodes in said knowledge graph to form said updated knowledge graph. 
 
     
     
       11. The method of  claim 8 , further comprising: classifying, by a classification engine, said first incident as being one of a short head incident and a long tail incident; if said first incident is classified as said short head incident, said orchestrator using said first set of remediation actions for resolving said first incident; and if said first incident is classified as said long tail incident, said method further comprising performing, by a web search module, a web search to determine a third set of remediation actions, wherein said orchestrator uses said third set of remediation actions for resolving said first incident, wherein each of said web search module and said classification engine is constituted of a corresponding set of software instructions. 
     
     
       12. The method of  claim 11 , wherein said classifying comprises:
 generating a machine learning (ML) model correlating a set of problem types contained in said plurality of incident reports to a number of occurrences of each problem type in said knowledge graph; and 
 predicting using said ML model, whether said first incident is one of said short head incident and said long tail incident based on a first problem type determined for said first incident. 
 
     
     
       13. The method of  claim 11 , further comprising combining said first set of remediation actions and said third set of remediation actions to generate a final set of remediation actions,
 wherein said orchestrator uses said final set of remediation actions for resolving said first incident. 
 
     
     
       14. The method of  claim 8 , wherein said first problem descriptor is one of a root cause of said first incident and a symptom caused by said first incident,
 wherein said first set of qualifier entities includes one or more of a performance metric associated with said first incident, a component of an application where said first incident occurred, a sub-component of said application where said first incident occurred, a location of a server hosting said component, and a problem type determined for said first incident, 
 wherein said first set of qualifier entities also includes said symptom when said problem descriptor is said root cause, and said root cause when said problem descriptor is said symptom. 
 
     
     
       15. A digital processing system comprising: a random access memory (RAM) to store instructions for recommending remediation actions; and one or more processors to retrieve and execute the instructions, wherein execution of the instructions causes the digital processing system to perform the actions of: receiving, by an entity extractor, a plurality of incident reports related to incidents identified by a performance management system, each incident report containing a corresponding problem descriptor for that incident, a remediation action performed for resolving that incident, and a set of qualifier entities associated with the incident, wherein said plurality of incident reports together contain a set of problem descriptors and a set of remediation actions; constructing, by a knowledge graph module, based on said plurality of incident reports, a knowledge graph that co-relates each of said set of problem descriptors with each of said set of remediation actions, wherein each of said set of problem descriptors is represented as a corresponding start node and each of said set of remediation actions is represented as a corresponding end node in said knowledge graph, wherein a set of qualifier entities in each incident report is represented as causal links between the start node and the end node corresponding to the problem descriptor and remediation action contained in the incident report; storing, by said knowledge graph, in a memory provided in said digital processing system; upon receiving a first incident report related to a first incident identified by said performance management system, extracting, by said entity extractor, from said first incident report, a first problem descriptor and a first set of qualifier entities; traversing, by said knowledge graph module, said knowledge graph starting from a first start node corresponding to said first problem descriptor using said first set of qualifier entities to determine end nodes representing a first set of remediation actions; causing, by an orchestrator, resolution of said first incident based on one or more remediation actions of said first set of remediation actions, and upon resolution of said first incident, said knowledge graph module updating said knowledge graph in said memory based on said first incident to form an updated knowledge graph, wherein said updated knowledge graph is stored in said memory and used for resolving a later incident report received after resolution of said first incident report, wherein each of said entity extractor, said knowledge graph module, and said orchestrator is constituted of a corresponding set of software instructions. 
     
     
       16. The digital processing system of  claim 15 , further performing the actions of: maintaining, by said knowledge graph module, a respective confidence score associated with each path from said first problem descriptor to each remediation action of said first set of remediation actions, wherein the confidence score for a path represents a likelihood of resolution of said first problem descriptor by the corresponding remediation action; and identifying, by a blender module, rankings for said first set of remediation actions based on the associated confidence scores, wherein said digital processing system also uses said rankings along with said first set of remediation actions to cause resolution of said first incident, wherein said blender module is constituted of a corresponding set of software instructions. 
     
     
       17. The digital processing system of  claim 16 , wherein said digital processing system extracts a second problem descriptor with a second weight along with said first problem descriptor with a first weight,
 wherein said traversing determines a second set of remediation actions and associated confidence scores for said second problem descriptor, 
 wherein said digital processing system identifies rankings for both of said first set of remediation actions and said second set of remediation actions together based on associated confidence scores weighted by the respective said first weight and said second weight, 
 wherein for said updating, said digital processing system performs the actions of adding one or more problem descriptors of said first incident report as corresponding start nodes and each of said one or more remediation actions as respective end nodes in said knowledge graph to form said updated knowledge graph. 
 
     
     
       18. The digital processing system of  claim 15 , further performing the actions of: classifying, by a classification engine, said first incident as being one of a short head incident and a long tail incident; if said first incident is classified as said short head incident, said digital processing system using said first set of remediation actions for resolving said first incident; and if said first incident is classified as said long tail incident, further performing the actions of performing, by a web search module, a web search to determine a third set of remediation actions, wherein said digital processing system uses said third set of remediation actions for resolving said first incident, wherein each of said web search module and said classification engine is constituted of a corresponding set of software instructions. 
     
     
       19. The digital processing system of  claim 18 , wherein for said classifying, said digital processing system performs the actions of:
 generating a machine learning (ML) model correlating a set of problem types contained in said plurality of incident reports to a number of occurrences of each problem type in said knowledge graph; and 
 predicting using said ML model, whether said first incident is one of said short head incident and said long tail incident based on a first problem type determined for said first incident. 
 
     
     
       20. The digital processing system of  claim 18 , further performing the actions of combining said first set of remediation actions and said third set of remediation actions to generate a final set of remediation actions,
 wherein said digital processing system uses said final set of remediation actions for resolving said first incident.